Model Context Protocol Vulnerability in MCP Atlassian for Confluence and Jira

CVE-2026-77252

What is CVE-2026-77252?

MCP Atlassian, a Model Context Protocol server for Atlassian products like Confluence and Jira, contains an input validation flaw that enables attackers to bypass administrator-set allowlists. By exploiting vulnerable arguments—specifically 'projects_filter' and 'spaces_filter'—unauthorized users can access projects and spaces beyond their intended permissions. This vulnerability allows poorly configured access controls to be manipulated, potentially exposing sensitive data. The issue has been addressed in version 0.22.0, which mitigates the threat by ensuring proper validation of user input throughout the system.

References